Re: [gentoo-security] tripwire-ish portage scanner

[Mark Guertin]

On 25-Mar-04, at 3:03 PM, Andrew Gaffney wrote:

> Tom Hosiawa wrote:
>>> On Thu, Mar 25, 2004 at 12:46:25PM -0600, Andrew Gaffney wrote:
>>>
>>>> I've come up with a quick n' dirty Perl script to use portage's
>>>> MD5s in a tripwire fashion.
>>>>
>>>
>>> Didn't you know about qpkg? qpkg already does this, qpkg -c checks
>>> mtime
>>> and md5sum for all packages. With -v it will list the exact files
>>> that
>>> mismatch.. The only thing that's lacking is checking the integrity of
>>> the md5sums themselves with some kind of signature.
>>>
>>> Regards,
>>>
>>> Michel Wilson.
>> What about qpkq being compromised itself. As I understand it, in
>> tripwire, cryptographic keys are used for the policy file.
>> Couldn't an attacker mess around with which files qpkq scans?
>
> That's another good reason for a customer portage-integrated solution.
>

Well in theory any file on a machine could have been compromised 
(including something built into portage).  if you want to be absolutely 
sure I would recommend having your scan tools on removable media and 
not dependent on anything on the machine you are scanning, like a USB 
flash drive on your keychain or the like.  As always it depends on how 
involved you want to get with things.

I wrote a little python script a while back that did pretty much the 
same sort of stuff, but I abandoned it as there were a lot of files 
that showed up in scans that most definitely weren't compromised ... 
many of which for good reasons (i.e. a newer package updated the file, 
user modifications, etc).  To do it this way it would have to be more 
than a simple script (taking into account duplicates, checking only 
against the newest modification date on duplicates, giving users the 
option to 'rescan' their files after they have made approved 
modifications of them, etc), and I wasn't willing to put that much 
effort into such script ;)

Mark



--
gentoo-security@g.o mailing list